DOCUMENTOVIEW_FACTURAEXPRESS_ESCANEAD_PDFN3D0L3BG5D[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

DOCUMENTOVIEW_FACTURAEXPRESS_ESCANEAD_PDFN3D0L3BG5D.exe
Size

17.5MB
MD5

50ddff6499a92473b78aa72984ffd19d
SHA1

10f580a58d6825461a193e4db993aa4dd8ff4230
SHA256

9ab830976899e92cc65af868ec8a3cc4b172408e11b33a4823523149d67437d7
SHA512

c9e6d3e75edb06588a8ea744fd636f7af81f481ef9397bc55599355c1de42289df18b3a2b3f01733a9c61580846f569b0df76b78f5cb7b2efc13deffa911e3fd
SSDEEP

393216:OuirsUMeggk88OnGGnp/uGak7Tah0rppoIY7dZC9IrnL:2ktOGGJDak7TaKt2IWjC9I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DOCUMENTOVIEW_FACTURAEXPRESS_ESCANEAD_PDFN3D0L3BG5D.exe

Files

DOCUMENTOVIEW_FACTURAEXPRESS_ESCANEAD_PDFN3D0L3BG5D.exe
.exe windows:6 windows x64 arch:x64

5f091eecefc1b49cd7a2a9cf6847cbb0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

comctl32

CreatePropertySheetPageW
PropertySheetW
InitCommonControlsEx

ws2_32

getaddrinfo
freeaddrinfo
ioctlsocket
listen
accept
WSAPoll
send
getpeername
connect
WSAGetLastError
ntohl
WSAAddressToStringW
htonl
htons
WSACleanup
WSAStartup
select
ntohs
getsockname
setsockopt
recv
bind
socket
WSASetLastError
closesocket
getsockopt
gethostname

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses

shlwapi

PathIsURLW
PathIsRelativeW
PathRelativePathToW
PathIsSameRootW
PathRemoveBackslashW
PathAddBackslashW
PathAppendW
PathFileExistsW

rpcrt4

UuidCreate
UuidToStringW

fwpuclnt

FwpmTransactionCommit0
FwpmEngineClose0
FwpmEngineOpen0
FwpmTransactionBegin0
FwpmCalloutAdd0
FwpmSubLayerAdd0
FwpmFilterAdd0

kernel32

GetTimeFormatW
GetDateFormatW
GetModuleHandleW
FindResourceW
SizeofResource
LoadResource
LockResource
FormatMessageA
LocalFree
GetLastError
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
GetFileSize
CloseHandle
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CopyFileW
DeleteFileW
MoveFileExW
Sleep
DeviceIoControl
CancelIo
GetOverlappedResult
LoadLibraryW
GetProcAddress
VirtualProtect
WriteProcessMemory
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
GetLocalTime
CreateDirectoryW
GlobalAlloc
GlobalLock
GlobalUnlock
GetFileTime
InitializeCriticalSection
DeleteCriticalSection
ResumeThread
SetThreadPriority
GetTickCount
SetProcessWorkingSetSize
GetVersionExW
GetSystemInfo
OpenMutexW
CreateMutexW
SetUnhandledExceptionFilter
CreateEventW
CreateThread
SetEvent
WaitForSingleObject
WaitForMultipleObjects
ResetEvent
FreeResource
MulDiv
ReleaseMutex
FormatMessageW
GetStartupInfoW
GetEnvironmentStringsW
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
CompareStringW
RtlVirtualUnwind
RtlCaptureContext
InitializeCriticalSectionAndSpinCount
RtlUnwindEx
RtlLookupFunctionEntry
RaiseException
PeekNamedPipe
GetFileInformationByHandle
SetFilePointerEx
IsProcessorFeaturePresent
IsDebuggerPresent
GetCommandLineW
GetCPInfo
FileTimeToSystemTime
GetDriveTypeW
FindFirstFileExW
FindClose
FileTimeToLocalFileTime
LoadLibraryExW
ExitThread
GetFileType
RtlPcToFileHeader
DecodePointer
EncodePointer
GetStringTypeW
ExpandEnvironmentStringsW
SetLastError
SleepEx
DeleteFileA
AreFileApisANSI
GetSystemTime
GetTempPathA
GetVersionExA
OutputDebugStringA
GetFileAttributesExW
GetDiskFreeSpaceA
CreateFileMappingA
LoadLibraryA
GetDiskFreeSpaceW
LockFileEx
HeapSize
GetTempPathW
FlushFileBuffers
GetFileAttributesW
HeapValidate
HeapCreate
GetFileAttributesA
HeapDestroy
GetSystemTimeAsFileTime
GetProcessHeap
UnlockFileEx
OutputDebugStringW
LockFile
UnlockFile
HeapFree
QueryPerformanceCounter
SystemTimeToFileTime
HeapAlloc
FreeLibrary
SetEndOfFile
HeapReAlloc
GetFullPathNameA
GetFullPathNameW
ReadFile
WriteFile
SetEnvironmentVariableA
SetFilePointer
CreateFileA
FreeEnvironmentStringsW
GetConsoleCP
GetConsoleMode
LCMapStringW
IsValidLocale
GetLocaleInfoW
ReadConsoleW
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
ExitProcess
IsValidCodePage
GetModuleHandleExW
GetACP
GetOEMCP
UnhandledExceptionFilter
SetStdHandle
GetTimeZoneInformation
GetCurrentDirectoryW
SetEnvironmentVariableW
WriteConsoleW
TlsFree

user32

ReleaseDC
GetDesktopWindow
CheckRadioButton
SystemParametersInfoW
IsWindowVisible
GetDC
DestroyWindow
SetDlgItemTextA
SendMessageW
LoadIconW
EndDialog
GetParent
LoadStringW
EnableWindow
GetWindowTextLengthW
GetDlgItem
SetDlgItemTextW
SetDlgItemInt
GetDlgItemInt
TranslateMessage
GetMessageW
SendNotifyMessageW
CheckMenuItem
GetCursorPos
GetAncestor
WindowFromPoint
GetSystemMetrics
RegisterWindowMessageW
PostQuitMessage
KillTimer
LoadImageW
SetTimer
AnimateWindow
InsertMenuItemW
PostMessageW
InsertMenuW
GetSubMenu
LoadMenuW
SetWindowTextW
DestroyMenu
TrackPopupMenuEx
SetForegroundWindow
AppendMenuW
CreatePopupMenu
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
CreateDialogParamW
CreateWindowExW
MapDialogRect
ShowWindow
SetWindowPos
CallWindowProcW
SendDlgItemMessageW
GetDlgItemTextW
GetMenu
MoveWindow
SetFocus
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
GetWindowRect
MessageBoxW
DialogBoxParamW
RegisterClassW
LoadCursorW
DefWindowProcW
EndPaint
FillRect
BeginPaint
GetClientRect
GetDlgCtrlID
InvalidateRect
GetWindowLongW
SetWindowLongW
CheckDlgButton
SetWindowLongPtrW
GetWindowTextW
IsDlgButtonChecked
GetWindowLongPtrW
DispatchMessageW

gdi32

GetDeviceCaps
GetStockObject
DeleteObject
CreateSolidBrush
CreateFontIndirectW

comdlg32

ChooseColorW
GetOpenFileNameW
GetSaveFileNameW

advapi32

DeleteService
RegQueryValueExW
RegCloseKey
RegDeleteValueW
ControlService
QueryServiceStatus
QueryServiceConfigW
CloseServiceHandle
OpenServiceW
CreateServiceW
OpenSCManagerW
StartServiceW
RegOpenKeyExW
RegSetValueExW

shell32

ord155
ShellExecuteW
Shell_NotifyIconW
ord680
SHBrowseForFolderW
SHGetPathFromIDListW

ole32

CreateStreamOnHGlobal
CoInitializeEx

oleaut32

OleLoadPicture

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 541KB - Virtual size: 540KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15.2MB - Virtual size: 15.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5f091eecefc1b49cd7a2a9cf6847cbb0

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

ws2_32

iphlpapi

shlwapi

rpcrt4

fwpuclnt

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 541KB - Virtual size: 540KB

.data Size: 26KB - Virtual size: 50KB

.pdata Size: 74KB - Virtual size: 73KB

.rsrc Size: 15.2MB - Virtual size: 15.2MB

.reloc Size: 18KB - Virtual size: 17KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 541KB - Virtual size: 540KB

.data
Size: 26KB - Virtual size: 50KB

.pdata
Size: 74KB - Virtual size: 73KB

.rsrc
Size: 15.2MB - Virtual size: 15.2MB

.reloc
Size: 18KB - Virtual size: 17KB